fix(build): use GITHUB_TOKEN for curl when needed (#709)

* fix(build): use GITHUB_TOKEN for curl when needed

* use /tmp instead of /usr/local

* missed one

* pass -E to sudo

---------

Co-authored-by: inffy <10782843+inffy@users.noreply.github.com>

.github/workflows/reusable-build.yml

@@ -73,8 +73,10 @@ jobs:
       - name: Build Image
         id: build-image
         shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          sudo $(command -v just) repo_organization="${{ github.repository_owner }}" \
+          sudo -E $(command -v just) repo_organization="${{ github.repository_owner }}" \
                     build-ghcr "${{ matrix.base_name }}" \
                                "${{ matrix.stream_name }}" \
                                "${{ matrix.image_flavor }}" \
@@ -105,8 +107,10 @@ jobs:
       - name: Rechunk Image
         id: rechunk-image
         shell: bash
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          sudo $(command -v just) rechunk "${{ matrix.base_name }}" \
+          sudo -E $(command -v just) rechunk "${{ matrix.base_name }}" \
                             "${{ matrix.stream_name }}" \
                             "${{ matrix.image_flavor }}" \
                             "1"

Containerfile

@@ -27,6 +27,7 @@ ARG VERSION=""
 RUN --mount=type=cache,dst=/var/cache/libdnf5 \
     --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,source=/,target=/ctx \
+    --mount=type=secret,id=GITHUB_TOKEN \
     /ctx/build_files/shared/build-base.sh
 
 ## aurora-dx developer edition image section
@@ -46,4 +47,5 @@ ARG VERSION=""
 RUN --mount=type=cache,dst=/var/cache/libdnf5 \
     --mount=type=cache,dst=/var/cache/rpm-ostree \
     --mount=type=bind,from=ctx,source=/,target=/ctx \
+    --mount=type=secret,id=GITHUB_TOKEN \
     /ctx/build_files/shared/build-dx.sh

Justfile

@@ -227,13 +227,17 @@ build $image="aurora" $tag="latest" $flavor="main" rechunk="0" ghcr="0" pipeline
     echo "::group:: Build Container"
 
     # Build Image
-    ${PODMAN} build \
-        "${BUILD_ARGS[@]}" \
-        "${LABELS[@]}" \
-        --target "${target}" \
-        --tag localhost/"${image_name}:${tag}" \
-        --file Containerfile \
-        .
+    PODMAN_BUILD_ARGS=("${BUILD_ARGS[@]}" "${LABELS[@]}" --target "${target}" --tag localhost/"${image_name}:${tag}" --file Containerfile)
+
+    # Add GitHub token secret if available (for CI/CD)
+    if [[ -n "${GITHUB_TOKEN:-}" ]]; then
+        echo "Adding GitHub token as build secret"
+        PODMAN_BUILD_ARGS+=(--secret "id=GITHUB_TOKEN,env=GITHUB_TOKEN")
+    else
+        echo "No GitHub token found - build may hit rate limit"
+    fi
+
+    ${PODMAN} build "${PODMAN_BUILD_ARGS[@]}" .
     echo "::endgroup::"
 
     # Rechunk

build_files/base/05-override-install.sh

@@ -18,7 +18,7 @@ dnf5 -y install \
   plasma-firewall-$(rpm -q --qf "%{VERSION}" plasma-desktop)
 
 # Offline Aurora documentation
-curl --retry 3 -Lo /tmp/aurora.pdf https://github.com/ublue-os/aurora-docs/releases/download/0.1/aurora.pdf
+ghcurl "https://github.com/ublue-os/aurora-docs/releases/download/0.1/aurora.pdf" --retry 3 -o /tmp/aurora.pdf
 install -Dm0644 -t /usr/share/doc/aurora/ /tmp/aurora.pdf
 
 # Starship Shell Prompt

build_files/dx/04-override-install-dx.sh

@@ -4,13 +4,13 @@ echo "::group:: ===$(basename "$0")==="
 
 set -eoux pipefail
 
-curl --retry 3 -Lo /tmp/kind "https://github.com/kubernetes-sigs/kind/releases/latest/download/kind-$(uname)-amd64"
+ghcurl "https://github.com/kubernetes-sigs/kind/releases/latest/download/kind-$(uname)-amd64" --retry 3 -o /tmp/kind
 chmod +x /tmp/kind
 mv /tmp/kind /usr/bin/kind
 
 # ls-iommu helper tool for listing devices in iommu groups (PCI Passthrough)
-DOWNLOAD_URL=$(curl --retry 3 https://api.github.com/repos/HikariKnight/ls-iommu/releases/latest | jq -r '.assets[] | select(.name| test(".*x86_64.tar.gz$")).browser_download_url')
-curl --retry 3 -Lo /tmp/ls-iommu.tar.gz "$DOWNLOAD_URL"
+DOWNLOAD_URL=$(ghcurl "https://api.github.com/repos/HikariKnight/ls-iommu/releases/latest" | jq -r '.assets[] | select(.name| test(".*x86_64.tar.gz$")).browser_download_url')
+ghcurl "$DOWNLOAD_URL" --retry 3 -o /tmp/ls-iommu.tar.gz
 mkdir /tmp/ls-iommu
 tar --no-same-owner --no-same-permissions --no-overwrite-dir -xvzf /tmp/ls-iommu.tar.gz -C /tmp/ls-iommu
 mv /tmp/ls-iommu/ls-iommu /usr/bin/

build_files/shared/build-base.sh

@@ -18,6 +18,11 @@ install -Dm0644 -t /etc/ublue-os/ /ctx/iso_files/*.list
 cp -r /ctx/just /tmp/just
 cp /ctx/packages.json /tmp/packages.json
 rsync -rvK /ctx/system_files/shared/ /
+
+mkdir -p /tmp/scripts/helpers
+install -Dm0755 /ctx/build_files/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
+export PATH="/tmp/scripts/helpers:$PATH"
+
 echo "::endgroup::"
 
 # Generate image-info.json

build_files/shared/build-dx.sh

@@ -9,6 +9,11 @@ echo "::group:: Copy Files"
 # Copy Files to Image
 cp /ctx/packages.json /tmp/packages.json
 rsync -rvK /ctx/system_files/dx/ /
+
+mkdir -p /tmp/scripts/helpers
+install -Dm0755 /ctx/build_files/shared/utils/ghcurl /tmp/scripts/helpers/ghcurl
+export PATH="/tmp/scripts/helpers:$PATH"
+
 echo "::endgroup::"
 
 # Apply IP Forwarding before installing Docker to prevent messing with LXC networking

build_files/shared/utils/ghcurl

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Check for GITHUB_TOKEN in /run/secrets/GITHUB_TOKEN (Podman secret mount)
+if [[ -f /run/secrets/GITHUB_TOKEN ]]; then
+  GITHUB_TOKEN=$(< /run/secrets/GITHUB_TOKEN)
+  echo "Using GITHUB_TOKEN from /run/secrets/GITHUB_TOKEN for authentication." >&2
+  AUTH_HEADER="Authorization: Bearer $GITHUB_TOKEN"
+else
+  echo "GITHUB_TOKEN secret not found. Using unauthenticated requests." >&2
+  AUTH_HEADER=""
+fi
+
+URL="$1"
+shift
+OPTIONS=("$@")
+
+if [[ -n "$AUTH_HEADER" ]]; then
+  curl -sSL -H "$AUTH_HEADER" "${OPTIONS[@]}" "$URL"
+else
+  curl -sSL "${OPTIONS[@]}" "$URL"
+fi